CAPEC - Common Attack Pattern Enumeration and Classification (A Community of Knowledge Resource for Building Secure Software)
Home > CAPEC List > CAPEC Standard Abstraction Attack Pattern List Release 1.4  

CAPEC Standard Abstraction Attack Pattern List Release 1.4
CAPEC Standard Abstraction Attack Pattern List Release 1.4

This view (slice) covers standard abstraction attack patterns.

Accessing Functionality Not Properly Constrained by ACLs - (1)
Accessing, Modifying or Executing Executable Files - (17)
Action Spoofing - (173)
API Abuse/Misuse - (113)
Argument Injection - (6)
Attack through Shared Data - (124)
Authentication Abuse - (114)
Authentication Bypass - (115)
Block Access to Libraries - (96)
Brute Force - (112)
Buffer Attacks - (123)
Bypassing of Intermediate Forms in Multiple-Form Sets - (140)
Cache Poisoning - (141)
Cause Web Server Misclassification - (11)
Checksum Spoofing - (145)
Choosing a Message/Channel Identifier on a Public/Multicast Channel - (12)
Clickjacking - (103)
Code Inclusion - (175)
Command Delimiters - (15)
Command Line Execution through SQL Injection - (108)
Common resource location exploration - (150)
Configuration/Environment manipulation - (176)
Content Spoofing - (148)
Create files with the same name as files protected with a higher classification - (177)
Create Malicious Client - (202)
Cross Site Request Forgery (aka Session Riding) - (62)
Cross Site Scripting through Log Files - (106)
Cross Site Tracing - (107)
Cross Zone Scripting - (104)
Cross-Site Flashing - (178)
Cross-Site Scripting in Error Pages - (198)
Cross-Site Scripting Using Alternate Syntax - (199)
Cross-Site Scripting Using MIME Type Mismatch - (209)
Cryptanalysis - (97)
Data Excavation Attacks - (116)
Data Interception Attacks - (117)
Data Leakage Attacks - (118)
Detect Unpublicised Web Pages - (143)
Detect Unpublicised Web Services - (144)
Directory Indexing - (127)
Discovering, querying, and finally calling micro-services, such as w/ AJAX - (179)
DNS Cache Poisoning - (142)
Double Encoding - (120)
Email Injection - (134)
Embedding Scripts in Nonscript Elements - (18)
Embedding Scripts within Scripts - (19)
Encryption Brute Forcing - (20)
Exploitation of Authorization - (122)
Exploitation of Session Variables, Resource IDs and other Trusted Credentials - (21)
Exploiting Incorrectly Configured Access Control Security Levels - (180)
Exploiting Multiple Input Interpretation Layers - (43)
Explore for predictable temporary file names - (149)
External Entity Attack - (201)
Fake the Source of Data - (194)
File Manipulation - (165)
File System Function Injection, Content Based - (23)
Flash File Overlay - (181)
Flash Injection - (182)
Flash Parameter Injection - (174)
Footprinting - (169)
Force the System to Reset Values - (166)
Forced Deadlock - (25)
Forced Integer Overflow - (92)
Forceful Browsing - (87)
Format String Injection - (135)
Fuzzing - (28)
Hijacking a Privileged Thread of Execution - (30)
HTTP Request Splitting - (105)
Identity Spoofing (Impersonation) - (151)
IMAP/SMTP Command Injection - (183)
Inducing Account Lockout - (2)
Infrastructure Manipulation - (161)
Injection (Injecting Control Plane content through the Data Plane) - (152)
Input Data Manipulation - (153)
Integer Attacks - (128)
LDAP Injection - (136)
Leverage Executable Code in Nonexecutable Files - (35)
Leveraging Race Conditions - (26)
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions - (29)
Leveraging/Manipulating Configuration File Search Paths - (38)
Lifting cached, sensitive data embedded in client distributions (thick or thin) - (204)
Lifting credential(s)/key material embedded in client distributions (thick or thin) - (205)
Lifting Data Embedded in Client Distributions - (37)
Lifting Sensitive Data from the Client - (167)
Lifting signing key and signing malicious code from a production environment - (206)
Locate and Exploit Test APIs - (121)
Log Injection-Tampering-Forging - (93)
Malicious Automated Software Update - (187)
Malicious Software Update - (186)
Man in the Middle Attack - (94)
Manipulate Application Registry Values - (203)
Manipulating hidden fields to change the normal flow of transactions (eShoplifting) - (162)
Manipulating Input to File System Calls - (76)
Manipulating Opaque Client-based Data Tokens - (39)
Manipulating User State - (74)
Manipulating User-Controlled Variables - (77)
Manipulating Writeable Configuration Files - (75)
Mobile Phishing (aka MobPhishing) - (164)
Object Relational Mapping Injection - (109)
OS Command Injection - (88)
Overflow Buffers - (100)
Parameter Injection - (137)
Passively Sniff and Capture Application Code Bound for Authorized Client - (65)
Password Brute Forcing - (49)
Password Recovery Exploitation - (50)
Path Traversal - (126)
Pharming - (89)
Phishing - (98)
PHP Remote File Inclusion - (193)
Pointer Attack - (129)
Poison Web Service Registry - (51)
Principal Spoofing - (195)
Probing an Application Through Targeting its Error Reporting - (54)
Programming to included script-based APIs - (160)
Protocol Reverse Engineering - (192)
Rainbow Table Password Cracking - (55)
Redirect Access to Libraries - (159)
Reflection Attack in Authentication Protocol - (90)
Reflection Injection - (138)
Relative Path Traversal - (139)
Removal of filters: Input filters, output filters, data masking - (200)
Removing Important Functionality from the Client - (207)
Removing/short-circuiting 'guard logic' - (56)
Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements - (208)
Resource Depletion - (119)
Resource Depletion through Allocation - (130)
Resource Depletion through Flooding - (125)
Resource Depletion through Leak - (131)
Resource Location Attacks - (154)
Reusing Session IDs (aka Session Replay) - (60)
Reverse Engineer an Executable to Expose Assumed Hidden Functionality or Content - (190)
Screen Temporary Files for Sensitive Information - (155)
Server Side Include (SSI) Injection - (101)
Session Credential Falsification through Forging - (196)
Session Fixation - (61)
Session Sidejacking - (102)
Simple Script Injection - (63)
Sniffing Attacks - (157)
Sniffing Information Sent Over Public/multicast Networks - (158)
Spear Phishing - (163)
Spoofing - (156)
SQL Injection - (66)
SQL Injection through SOAP Parameter Tampering - (110)
Subvert Code-signing Facilities - (68)
Subverting Environment Variable Values - (13)
Symlink Attacks - (132)
Target Programs with Elevated Privileges - (69)
Time and State Attacks - (172)
Try All Common Application Switches and Options - (133)
URL Encoding - (72)
User-Controlled Filename - (73)
Variable Manipulation - (171)
Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS)) - (82)
Web Logs Tampering - (81)
Web Server/Application Fingerprinting - (170)
Windows ::DATA Alternate Data Stream - (168)
XEE (XML Entity Expansion) - (197)
XML Parser Attack - (99)
XML Ping of Death - (147)
XML Schema Poisoning - (146)
Page Last Updated: September 09, 2009
 

CAPEC is sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

Vision and Technical Leadership provided by Cigital, Inc.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CAPEC and the CAPEC logo are trademarks of The MITRE Corporation.

Contact capec@mitre.org for more information.
Privacy policy
Terms of use
Contact us